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■ Problem: Estimating the risk of terrorism to a 
system depends upon the range of attack 
scenarios available to the adversary. 


■ Approach: Use logic gate trees (LGTs) to 
represent subject matter expert (SME) 
knowledge in a model that provides the basis for 
the risk analysis. The LGTs are developed using 
the Logic Evolved Decision (LED) methodology. 
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■ Structure of a Terrorist Attack 


■ LED Models for the Air Transportation 
System (ATS) 

■ Scenario Groupings, Concept of 
Operations (CONOPS), and Technology 
Insertions 


■ The Role of Expert Elicitation 

■ Conclusions 
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Risk-based Prioritization of 
NASA Aviation Security Research 



NASA Goal: 

- Use a top-down analysis approach to rank order security 
technology investments 

Objective: 

- Decision support tool to prioritize aviation security 
research 

- Based upon an air transportation system (ATS) risk 
assessment 

Technical Challenges: 

- Pioneering development effort 

- Security assessments for the entire ATS 
Extensive integration of subject matter experts 
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LOGIC EVOLVED 


Structure of a Terrorist Attack 
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An Attack Scenario Is A Process Q] 


Description of the process an 



ANZAMK-H 


Planning 


Logistics 


Assault 


Attacker 


For the ATS a very large 
number of scenarios are 
possible 


adversary carries out 
operations against a target 
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Selection 


Target 
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LED Models for the ATS 
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Possible Scenarios Are Generated 


Using LGTs with LED 



1. Develop a Possibility Tree 

■ Composed of elements of a process 

Logical operators (i.e., and/or) connect elements 

Deduction facilitates capturing a large set of 
possible scenarios 

2. Solve the Possibility Tree 

■ Generate scenarios from logically linked elements 

■ Prune the tree to develop a spanning set of 
scenarios 




Logic Gate Tree for Attacks against the ATS 




Airports 
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Individual Sub Trees Follows LGTs allow for convenient 
Logical Decomposition modularization of the 

attack space 


A terrorist attack is mounted against the United States Air Transportation System (ATS). 
^6 An attack against aircraft. 

$ An attack against a Part 1 21 PC (passenger and cargo) aircraft 
^ An attack against a Part 1 21 AC (all cargo) aircraft. 

An attack against a Part 1 35 aircraft. 


An attac 


<. again 
<. again: 


st a Part 91 aircraft. 


An attack against airports. 

An attack against the national airspace 
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Possibility Tree for Part 121 PC Attack Scenarios [J] 





File Edit View Search Windows Help 
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| Replicated Events 




Attack on the U 


Attack is against the commercial aviation system. 

E The targeted system is classified as a Part 1 21 air carrier operation. 

E The air carrier operation handles passengers and cargo traffic. 

O The attack targets passengers/crew.'' 

a The attack targets the aircraft. — ^ m , — 

A The tL* is A ttack Types 

O on the airframe. 

on critical on-board systems. 

The attack uses the aircraft as an enabling system. 









The Possibility-Tree Solution Gives a 
Comprehensive Set of Attack Scenarios 
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Attaclyon the US aviation system. Attack is against the commercial aviation 
system. The targeted system is classified as a Part 121 air-earner operation. The 
air-carrier operation handles passenger and cargo traffic. The/attack targets the 
aircraft. The attack is on the airframe. The attack originates external to the aircraft. 
The attack involves weaponry. The weapon used is a man-portable missile. The 
attacker acquires the weapon system. The attacker transports the missile system 
to the attack site. The attacker acquires the target. The attacker fires the missile. 
The missile flies to the target. The missile warhead detonates. The attacker group 
consists of outsiders only. 

Attack scenarios appear in 
natural language form for 
use with SMEs 
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Scenario Groupings, CONOPS, and 
Jechnology Insertions 
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Summary Attack Scenarios in Spanning 
Set for Part 121 PC Aircraft 


Type of Attack 

Number of 
Scenarios 

Example 

Attack on crew or passengers 

4 

Dispersion of chemical agent in passenger 
compartment 

Attack on airframe 

20 

Missile attack with man-portable system 

Attack on critical on-board systems 

24 

Jamming or spoofing of navigational aids 

Use of aircraft as an enabling system for 
weapons-of-mass-destruction attack 

4 

Variations of 9/11 World Trade Center 
attack 


Screening process for developing a workable sub-set of 
scenarios that are representative of a larger class of attacks. 




Similar spanning sets were 
developed for airports and the air 
space in consultation with SMEs 
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Concept of Operations for Technologies 




Technology CONOPS 

CONOPS processes converted into LED trees 
Define technology insertion points 
Operations are fine-tuned 
Gaps and functional requirements result 


A An attack against aircraft. 

^ An attack against a Part 1 21 PC (passenger and c 

An attack against a Part 121 AC (all cargo) aircraft. 
An attack against a Part 1 35 aircraft. 

An attack against a Part 91 aircraft. 

An attack against airports. 

An attack against the national airspace. 


Define how the overall system functions 

Discover technology interactions, gaps, and system impacts 

Identify responsibilities and information transfers between 
system components 

CONOPS based system requirements for 
technologies 

Define and optimize system operating parameters 
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The Role of Expert Elicitation 






Many Different Types of SMEs 
Participated in the Analysis 



■ National Institute of Aerospace (NIA) 

Aviation System Expert Consultants 

■ Aviation Operations 

- Pilots 

Airport Managers 
Air Traffic Controllers 

■ Air Force Research Laboratory (AFRL) 

Electromagnetic Effects Expertise 

■ NASA Aviation Security Research Projects 

Research Project Input to Analysis 

■ Volpe Center Department of Transportation (Volpe) 

Cost/Benefit Studies 

■ Experts on terrorism from various agencies 



SME Roles 



Definition of system for analysis 

Development of attack scenario possibility 
trees 

Selection of spanning sets 

Revision of trees and sets based upon 
initial risk assessment 

Development of CONOPS and 
identification of technology insertion points 
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Conclusions 


To be meaningful, terrorist risk analyses must have 
well-defined set of attack scenarios 

Logic gate trees provide a structured approach to scenario 
development 

The possibility tree contains a very large set of scenarios 
Spanning sets can be developed for different purposes 

An LGT model can be extended to incorporate 
CONOPS and to help define technology 
requirements 

Terrorist risk analysis is highly dependent on SME 
knowledge 

Possibility trees are an efficient way to integrate large 
amounts of expert knowledge 

- A tree can be easily updated to reflect new information or 
modified as a result of SME interactions 








Aviation Security Risk Assessment 7 Step Development Process 
Technology CONOPS Development Integral Part of Process 



Step 1 : 

Brainstorm Attack Scenario Possibilities 




Step 2: 

Develop Attack Scenarios 


Step 3: 

Defender and Attacker 







Step 4: 

Identify Attack Scenario Baseline Risk 


Steps 1-4: 
Determine 
Accident 
Scenario 
Baseline Risk 


Steps 5-7: 

Prioritize 

Preventive/ 
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Mitigating 
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Step 5: 

Apply P/MMs (Technologies) to Scenarios 




Step 6* 

Evaluate Ideal Risk Reduction Potential 




Step 7: 

Prioritize Final Risk Reduction 
Capability Using Additional Attributes 




















ATS Risk Assessment Development Process l^: 


Step 1: Think Like a Terrorist 


Step 2: Develop Attack Scenarios 


Structure of a Terrorist-Attack Scenario 
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File Edit View Search Windows Help 


| Replicated Events 


Attack on the US Aviation system. 


Attack is against the commercial aviation system. 

23 The targeted system is classified as a Part 1 21 air carrier operation. 

a The air carrier operation handles passengers and cargo traffic. 

O The attack targets passengers/crew. 

£5) The attack targets the aircraft. 

A The attack is 

<C> on the airframe. 

O on critical on-board systems. 

O The attack uses the aircraft as an enabling system. 


Step 3: Develop Risk Models 

for Defender and Attacker ■ Ste P 4: ldentif y Attack Scenario Baseline Risk 
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Dependence of Scenario Risk on Attacker Type 


New Risk Model 


□ Base Case Outsider 

Attack with Insider ■ Base Case Insider 



Scenario Risk Estimate 

Defender's Likelihood Estimate of Successful Attack Using the Scenario 

Scenario Attempt Likelihood 


Scenario Attractiveness to the adverse 


( Likelihood of Choosing ) 


Availability of comparable Non-aviation alternative scenarios 

Defender's Estimate of Scenario Success Likelihood Given an Attempts 

0 Defender's expected consequence of the scenario given a successful attack 




( Consequence) 


(Likelihood of Success 
given Choice ) 
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Scenario 
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The Possibility Tree Solution Gives a 
Comprehensive Set of Attack Scenarios 
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Step 2 Details: 

Attack Scenario Development 
Using LED Approach 


File Edit View Search Windows Help 
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Attack on the US Aviation system. 


£5 Attack is against the commercial aviation system. 

£5 The targeted system is classified as a Part 1 21 air carrier operation. 

A The air carrier operation handles passengers and cargo traffic. 

O The attack targets passengers/crew. 

^ The attack targets the aircraft. 

A The attack is 

O on the airframe. 

O on critical on-board systems. 

O The attack uses the aircraft as an enabling system. 






/ 


Attack on the US aviation system. Attack is against the commercial aviation system. The targeted system 
is classified as a Part 121 air-carrier operation. The air-carrier operation handies passenger and cargo 
traffic. The attack targets the aircraft. The attack is on the airframe. The attack originates external to the 
aircraft. The attack involves weaponry. The weapon used is a man-portable missile. The attacker acquires 
the weapon system. The attacker transports the missile system to the attack site. The attacker acquires 
the target. The attacker fires the missile. The missile flies to the target. The missile warhead detonates. 
The attacker group consists of outsiders only. 
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Step 3 Details: Inferential Risk Model Development 

Security RISK ... of a Scenario or Attack must account for INTENT 

( Likelihood of Choosing) ® (Likelihood of Success given Choice) ® (Consequence) = RISK 


■ Recognizes Factors Contributing to Risk 

■ Logical Operators (i.e., and/or) Connect Factors 

■ In lieu of Reasonable Probabilities, Risk is Inferred by Chaining Rule 
Bases According to Model Logic Using: 


Linguistic Variables - Approximate Reasoning - Fuzzy Membership Sets 
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New Risk Model 
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a cenario Risk Estimate 

Defender's Likelihood Estimate of Successful Attack Using the Scenario 







Aviation Security Research Portfolio Prioritization 


Step 6: Prioritize Ideal Risk Reduction Potential 



I | Stand-Alone 
I I Integrated 
I Enhanced Integration 


Tech 1 


Tech 2 


Results In: 


1) Technologies Prioritized Based on Risk 
Reduction Potential for Three Levels of Integration 

2) Risk Assessment for ATS 


Prioritizing Aviation Security Research 

Identify a spanning set of possible scenarios 
Map the PM suites onto the possible scenario set 


Preventive/M itigati ng 
Measure Suite 
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Scenarios 

I - 11 


Addressed 


Technologies Evaluated for Three Categories 

■ Stand-Alone 

■ Integrated 

■ Enhanced Integration 


SncLState^AGhieved 


-Technologies Prioritized Based Upon a 
Comprehensive Risk Assessment. 


Step 5: Map Technologies to Scenarios 
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Step 7: Prioritize Final Risk Reduction Capability | L f | 


Ideal Risk Reduction Potential input 

■ Costs 

Development 

Operating 

■ Capital 

■ Consequence 

■ Benefit 

■ Technical Risk 

Technology development 
Dependencies 

■ Complexity 

■ Implementation Risk 

Certification 
Cultural issues 

■ User acceptance 

■ Technology Readiness Level 

■ Cost 

Funding available for technology development 

Schedule 

Time available for technology development 

National Needs Based Time Frame for Technology 
Development 

Technology Impact on Throughput Volume 

■ Delay introduced by technology insertion 

■ Technology impact on demand 
Technology impact on capacity 


rauii^i 



Final Risk 
Reduction 
Capability 
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